CVE-2024-23652

BuildKit possible host system access from mount stub cleaner

Severity Score

9.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the host system. The issue has been fixed in v0.12.5. Workarounds include avoiding using BuildKit frontends from an untrusted source or building an untrusted Dockerfile containing RUN --mount feature.

BuildKit es un conjunto de herramientas para convertir código fuente para crear artefactos de manera eficiente, expresiva y repetible. Una interfaz de BuildKit maliciosa o un Dockerfile que use RUN --mount podría engañar a la función que elimina archivos vacíos creados para los puntos de montaje para que elimine un archivo fuera del contenedor, del sistema host. El problema se solucionó en v0.12.5. Los workarounds incluyen evitar el uso de interfaces de BuildKit desde una fuente que no sea de confianza o crear un Dockerfile que no sea de confianza que contenga la función RUN --mount.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2024-01-19 CVE Reserved
2024-01-31 CVE Published
2024-02-09 EPSS Updated
2024-03-01 First Exploit
2024-08-01 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC
https://github.com/abian2/CVE-2024-23652	2024-03-01

URL	Date	SRC
https://github.com/moby/buildkit/pull/4603	2024-02-09
https://github.com/moby/buildkit/releases/tag/v0.12.5	2024-02-09

URL	Date	SRC
https://github.com/moby/buildkit/security/advisories/GHSA-4v98-7qmw-rqr8	2024-02-09

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mobyproject Search vendor "Mobyproject"		Buildkit Search vendor "Mobyproject" for product "Buildkit"				< 0.12.5 Search vendor "Mobyproject" for product "Buildkit" and version " < 0.12.5"		-		Affected